Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this:

SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:HIGH:!ADH:!AES256-SHA:!ECDHE-RSA-AES256-SHA384:!AES128-SHA:!DES-CBC:!aNull:!eNull:!LOW:!SSLv2

However, https://www.ssllabs.com reports the following ciphers are allowed:

  • TLS_RSA_WITH_RC4_128_SHA
  • TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  • TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  • TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  • TLS_RSA_WITH_3DES_EDE_CBC_SHA

How can I configure apache to only allow RC4?

share|improve this question
1  
Disable all but RC4? That's a new one. Mitigating BEAST only requires that RC4-SHA be the first cipher offered, which you had already done, not disabling everything else. –  Michael Hampton Sep 20 '12 at 21:25
    
I didn't really want to do it, but when I called them, they insisted on only having RC4 enabled. (I think they would allow TLS 1.1 or 1.2 ciphers, but few clients support those) –  Daniel Sep 20 '12 at 21:35
3  
Oh, in that case they're idiots and you should go find another vendor. –  Michael Hampton Sep 20 '12 at 21:35
2  
What @MichaelHampton said. Your auditor's understanding of security (at least WRT crypto algorithms) is fundamentally flawed (and it's worth noting that RC4 (at least RC4-CBC) has its own theoretical flaws. You should find an auditor who understands this stuff a bit better, or bone up on it enough to argue them into submission... –  voretaq7 Sep 20 '12 at 21:45

2 Answers 2

403 labs is my PCI DSS compliance scan vendor. They require only RC4-SHA for SSL 3.0 and TLS 1.0. Their reasoning is that moving RC4-SHA to the top is the server preferred cipher suite not the clients. So the client could negotiate a block cipher on the list that is vulnerable to beast. Which all TLS 1.0 CBC ciphers are.

On my Apache server I only have RC4-SHA enabled. On my IIS boxes I have RC4-SHA plus all the TLS 1.2 only ciphers enabled.

share|improve this answer
up vote 2 down vote accepted

Turns out it was pretty easy. The "High" option in my original question was including the other ciphers. By reducing it to the following, I got what I wanted:

SSLCipherSuite RC4-SHA
share|improve this answer
    
The reason for that was the allow of HIGH, which adds all of the ciphers from that set. –  Shane Madden Sep 20 '12 at 23:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.